This tutorial uses the deprecated mysql extension (as of PHP 5.5.0) which should not be used for writing new code as it will be removed in the future. The mysqli (MySQL Improved) or PDO extension should be used instead.

Nevertheless, it has been decided to keep this tutorial available until such time as it has been either updated or re-written. In the meantime, if you wish to take the tutorial, then it is recommended that you change the mysql-extension code to use mysqli or PDO. (If you do this successfully then perhaps you might consider submitting a revised tutorial, contributing to dream.in.code and earning some Kudos!)

SQL Injection is a form of hacking that has taken down innumerable amounts of websites, and it's no comforting idea that your site could be next. In this tutorial, I will give you a brief synopsis of what SQL Injection really is, and how to protect your website from it. This tutorial assumes that you have a fairly good knowledge of PHP, you understand GET and POST methods, and you have used and at least partly understand SQL.

SQL Injection is usually done through areas where user input is added into a database, or where GET/POST values are parsed and added into a database. For example, this is a piece of code that will get a POST value and add it to the database:

That code is all fine and dandy, but what if someone visited the page like this:http://example.com/update.php?value=blah'); DELETE * FROM table WHERE value != 0; INSERT INTO table VALUES('HACKED!
This would make an SQL query:INSERT INTO table VALUES('blah'); DELETE * FROM table WHERE value != 0; INSERT INTO table VALUES('HACKED!')
That is one piece of malicious code. This would essentially delete all rows from the database, except for ones with a value of 0. Then, you would probably have one row which would let you know that you were hacked.

Quote

Editorís Comment

Prepared Statements are state-of-the-art when it come to preventing SQL Injections. Please read the discussion following this topic to learn more about it.

Now you probably want to know how to protect your site(s) from this, right? It's fairly simple, actually.

Now let's put this into action. Remember the code we had earlier? Let's change that:mysql_query("INSERT INTO table VALUES('" . sql_sanitize($_GET["value"]) . "')");
This will "sanitize" the code and protect your database from people doing anything malicious to it.

Well, there you go! I suggest you implement this method wherever you are putting user input into the database. Instead of using $_GET["value"], for instance, just use sql_sanitize($_GET["value"])! It really is that simple.

It would probably best not to try addslashes at all. There are far too many vectors to get around addslashes. PHP 4 will be EOL'd starting Jan 1, 2008 for a reason. Just FYI. If I wanted to try out SQL injection, I'd find out the PHP version first, to see if I could just fire in some escape codes and the like to get it to error out.

After reading the article, I still don't quite get what's the problem with not sanitizing the GET parameters when using PHP-MYSQL (in terms of unauthorized insertions/deletion of data). For instance, with regard to the sql injection example in the article,

since php mysql_query method does not support multiple queries, so stacking queries as the example above should not work (will throw sql error). Is there really anyway to put sql injection into a php-mysql script even without the sanitization of the GET parameters? Hope you can shed some more light on this subject. Many thanks.

You would want to sanitize everything you put into any query sent to the database server that is not hard coded in the script! It doesn't matter if the query is to retrieve information or to insert information, everything has to be sanitized and nothing can be trusted! It's that simple!

Okay, I can understand why it would be far more effective than using a PHP function. Now, could you, or anyone else that understands this, possibly create a simple example of how to use a prepared statement with PHP?